So let's walk through a quick scenario.
We know that we want to form an IPsec tunnel
between our edge routers.
And so that's great and all except we have also said
that I'd like to form an IPsec tunnel per service provider
network because I want to have redundancy something
along these lines.
And so that's great and all except how do I go about
reaching out to this other edge device?
How do I form an IPsec tunnel?
We can use the validator to tell us
who should initiate the communication.
The question is, how do I get there?
Well, it's one thing to say, OK, well, let's just give it
an IP address.
So I'll give the IP address for this particular router,
except it doesn't answer a few different questions.
First of all, which service provider do I use in order
to connect that IP?
Also, am I going to use IPsec?
Or am I going to use GRE?
And on top of that, does the IP address
equal the identifier for that device?
We know that these layer three devices
have a lot of layer three interfaces.
And so I don't want to look at an IP address and wonder,
is that the same interface, or I should say,
is that the same router as another IP address?
So this router might have, let's say, two IP addresses.
And if I'm given these two IP addresses, IPA and IPB,
do those belong to the same device?
That's the question we're trying to answer here.
So there's a lot of very important information here,
which we need to have a good understanding of before we
can even think about initializing a connection
to the other side to form those tunnels.
So three very important pieces of information
and those three pieces of information
are going to be wrapped up inside of the transport locator,
otherwise known as the T-lock.
The T-lock is known as a three tuple, which
is a really fancy phrase for just saying
it has three pieces of information.
And hey, guess what?
We just said that we needed three pieces of information.
How about that?
So let's go through these.
So first of all, we're going to have
the concept of the system IP.
The system IP importantly is the identifier for a router.
So if I have a system IP that, by the way,
this is kind of cool, it doesn't need to be routable.
I don't need to know how to get there.
This is not how I'm going to reach the device.
This is simply an identifier for the device.
So I could use an IP address that is part of a subnet
that I just split out across all of these devices.
Maybe I want to reserve the 10.255--
that's a 295-- 255.255.x or whatever.
And I just deploy an IP address to all of my edge devices
that's going to serve as an identifier, not a routing point.
So cool.
Now we have an identifier for this device.
Now we also are going to have a color.
The color is a fairly long conversation.
And we're going to unpack it a little bit at a time.
And we'll start with this.
The idea of a color is to identify, essentially,
the WAN circuit that this T-lock belongs to.
Now this is important because what we just said
was the color part of the T-lock identifies a WAN circuit.
How many WAN circuits are there per device?
Two, three, four, depending on the scenario.
Usually at a minimum, we're going
to have a connection to two different WAN service providers.
Well, if the T-lock is mapped to one of these,
then that means that we're going to have multiple or many T-locks
per edge device.
Each T-lock represents a connection.
And that is the part that takes a while
to really make sure we understand and grasp.
It's emulating the concept of a connection.
It's telling us, hey, do you want to connect--
what are we connecting to?
We're connecting to this T-lock.
This T-lock identifies the device via the system IP.
It tells us which WAN circuit to use.
And it's also going to tell us which type of tunnel
to form, which we'll mention here in a moment.
So what exactly is the color?
How do we use it?
Well, the color is also not estimate or not similarly.
The color is a string.
This string is predefined by the system.
We have a lot of different strings.
We also have private strings and public strings, which
let somebody know, trying to make a connection,
whether this is a device that's publicly available,
like on the internet, or privately available, like with MPLS.
So we've got a lot of these predefined strings.
And we'll take a look at these when
we get to the configuration section.
But we can see strings such as red and green.
So we can use a literal color.
Or we could have a color that is a little bit more
indicative of a quality.
So we could use silver or gold.
And then we can also use strings that aren't necessarily
tied to a color.
So I could actually use, for example, MPLS
as a potential color, which will tell me
that I'm part of an MPLS circuit.
If we only have one MPLS circuit, then maybe it makes sense
to use this.
So how we use these strings is going
to be up to each individual organization.
Now, lastly, we also have the encapsulation.
And the encapsulation is simply, is this an IP set connection?
Or is it GRE?
So essentially, what Cisco is saying
is when we have an edge router here,
that we are going to have effectively these T-locks
that are going to be the connection point for the router,
but behind physical interfaces, which connect
to different win links.
Why do I say they're behind layer three interfaces?
Well, very importantly, what do we see in this three tuple?
We see system IP, color, and encapsulation.
What do we not see in the three tuple?
We do not see an IP address for connectivity.
That is not included in the T-lock.
This T-lock must be advertised out and said that, hey,
if you want to attach to this T-lock,
you're going to connect in via a specific public IP address,
or private IP address for that matter.
So how exactly do we form these connections between T-locks?
Because this router that's initiating down here
has the T-locks, and they're behind these public IP addresses
as well.
So what exactly we're going to do to make this connection happen?
Well, this is the role of the controller or the vSmart.
And what we'll find with this controller, again, operating
in the control plane, is that remember,
we've got these tunnels where we can push information down
to the edge devices.
Specifically, we're going to use that overlay management
protocol that we've mentioned, and we're
going to talk about it in a little bit more detail here
coming up.
We're going to use this protocol to push information down.
It's not just about subnets, advertising routes.
We're also going to include other information.
And so now, this router knows if it wants to connect to this T-lock--
let's just call this T-lock A up here--
T-lock A is available via a specific IP address.
So this is the glue that allows us to connect our T-locks together.
And so is the T-lock a layer 3 interface that forms an IP
sectional?
No, that's not what the T-lock is.
The T-lock is representing connection points.
However, we want to think about it.
But it's going to allow us to identify that, OK, so now
that I know I want to reach out from this T-lock to this T-lock,
now I know, first of all, to use the--
let's say it's the MPLS side.
First of all, I know to use MPLS.
Second of all, I know to use the IPs
and capsulation.
And third of all, I understand the actual router
that I'm connecting to.
So I might already have a connection to the same router
over here via a different WAN circuit.
And now I understand that via the T-lock.
The T-lock is a very important part of our architecture.
It's going to allow us to connect our edges to our other edges.
But an important part of this is the glue that holds it
together is going to be the T-lock routes which
come from the controller and allow devices
to have actual IP addresses they can use for connectivity.